Privacy policy

Who this is about

The Harmonyc Group LLC is a creative technology studio in New York City. This policy covers theharmonycgroup.com and nothing else. Work we build for clients runs on their own systems under their own policies.

For anything in this document, including a request to see or delete what we hold, write to us through the contact form. It is our only public channel, so it is also the address for privacy requests.

What we collect

When you write to us

The contact form asks for your name, your email address, your company if you want to give it, a budget band, and your message. All five go into a database we run ourselves before any email is sent, so a mail provider having a bad day cannot lose your message.

We deliberately do not record your IP address, your browser’s user-agent string, or the page you arrived from. Answering someone does not require their fingerprint. The form also carries a hidden field that automated submitters fill in and people do not, and it stops accepting messages if more than twenty arrive in a minute. Neither of those needs to know who you are.

When you allow analytics

Analytics is off when you arrive. Nothing measures you unless you choose “Allow analytics”, and that choice only ever loads on the home page. If you allow it, a Google Tag Manager container loads two things:

• Google Analytics 4 counts visits and how people move through the page.
• Microsoft Clarity records page interactions, including pointer movement, clicks and scrolling, and replays them as a session so we can see where the page confuses people.

Advertising storage, advertising personalisation and ad user data stay switched off in both, whatever you choose. We do not run ads and we do not build advertising profiles.

If you allow analytics and then send us a message, we record that a message was sent. Not what it said, not who sent it. One event with no details attached.

Running the site

Our host processes ordinary connection data, including IP addresses, to serve pages and absorb abuse. That is the host’s operational logging, not something we collect into our own systems or use to build a picture of you.

What gets stored on your device

Two values are always stored, and neither is sent anywhere. Both live in your browser’s local storage:

harmonyc-analytics-consent-v1

Your analytics choice, so the site stops asking.

harmonyc-theme

Whether you picked the light or dark appearance, so the page does not flash the wrong one.

Cookies are only set if you allow analytics. Then these appear on this domain:

_ga, _ga_RFP74TT5FX

Google Analytics. Distinguishes one browser from another and holds the session state.

_clck, _clsk

Microsoft Clarity. Keeps a Clarity user ID and joins several page views into a single recording.

Microsoft may also set cookies on its own domains, including CLID, MUID, ANONCHK, MR and SM. We cannot read or delete those from here. Your browser’s cookie settings can.

Who else handles it

We keep the list short on purpose. Each of these does one job:

Vercel

Hosts the site and serves every page.

Neon

Runs the database your enquiry is stored in.

Resend

Delivers the notification that tells us an enquiry arrived. It carries your message so we can read it.

Google

Tag Manager and Analytics, only after you allow analytics. Also the sign-in for our own staff areas, which no visitor uses.

Microsoft

Clarity, only after you allow analytics.

We do not sell your personal information, and we do not share it for anyone else’s advertising. Nothing here is sent to a data broker.

Why we are allowed to

If the UK GDPR or the EU GDPR applies to you, these are our lawful bases. Analytics runs on your consent, which is why nothing loads until you give it and why you can take it back at any time. Handling your enquiry rests on our legitimate interest in answering people who write to us, and on taking steps at your request before any agreement. Keeping the site standing and turning away automated abuse is also a legitimate interest.

How long it is kept

Enquiries stay for as long as we are talking, and afterwards for as long as we need a record of who approached the studio and what was discussed. We remove what we no longer have a reason to hold, and we delete anything on request.

Analytics data expires on the providers’ own clocks. Google Analytics is set to drop event-level data after two months and user-level data after fourteen months of inactivity. Clarity keeps session playback for thirty days and its aggregated click data for nine months.

Your choices

Analytics. Use “Privacy choices” at the foot of the home page to change your mind in either direction, whenever you like. Switching it off signals both providers to stop, clears the analytics cookies on this domain, and reloads the page into the off state. Because nothing starts without your explicit choice, a browser signal such as Global Privacy Control has nothing here to switch off.

Your data. Depending on where you live, you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or ask for it in a portable form. Withdrawing consent does not undo what was lawfully done beforehand.

Send any of these through the contact form and we will answer within a month. We do not charge for it, and we will not ask you for more identification than we need to find your record. If you are in the UK, the EEA or Switzerland and you are unhappy with our answer, you can complain to your national data protection authority.

If you are in California

We do not sell or share personal information as the CCPA uses those words, and we have not in the past twelve months. We do not use it to profile you or to make automated decisions about you. Exercising any right on this page will never get you worse treatment from us.

Where it goes

The studio is in the United States, and so are the providers above. If you write to us from the UK, the EEA or Switzerland, your message is transferred to the United States. These providers rely on the European Commission’s standard contractual clauses or an equivalent approved transfer mechanism.

Children

This site is for people commissioning professional work. It is not directed at children under sixteen and we do not knowingly collect anything from them. If a child has sent us something, write to us and it will be deleted.

Changes

When this policy changes, the date at the top and the bottom of the page changes with it. If a change materially affects what we do with something you have already given us, we will say so on the site rather than quietly amend the text.